You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Register a free account to unlock additional features at BleepingComputer.com

Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

These popups are killing me!

Hi - i'm trying to help my brother eradicate his computer from popups. I ran webroot spy sweeper and found an adware file/program and several malicious cookies. no sooner had we started celebrating our victory against popups that we received yet another one, which was from ads1.revenue.net (if this helps isolate the problem, i'm not sure). anyway, here is my hijackthis log file:

BC AdBot (Login to Remove)

Hello murph80. I assume Damian is the brother then? Someone has downloaded Messenger Plus! 3 and included the sponsors with the download. This is a gift from the nice folks at Messenger Plus! 3 (nothing to do with Microsoft or MSNIM) Here is a little information about the item.http://www.spywareinfo.com/articles/lop/ Since LOP came in with Messenger Plus! 3 try this canned fix created by Elrond first. Follow the directions exactly. It has been working about 99% of the time, if it should not remove the junk, then move to the uninstaller. Thanks.

You have a LOP infection that often comes together with Messenger Plus. To remove it we will try the simple way first.

2. The "Messenger Plus! - Setup" is now displayed. Click on the Uninstall button. Note: options displayed on the first screen are not related to the sponsor program.

3. The sponsor screen is now displayed (if you don't see it, search for it in your Task Bar). To prove that someone is currently reading the screen, you have to type the code that is displayed. Once you enter the code, press Uninstall.

4. If you entered the code properly, the program will ask you to confirm that you want to uninstall. You must answer "Yes" to this question, else, you won't have another chance of uninstalling.

5. To complete the uninstallation, follow the instructions that are displayed (the first one is to close all your Internet Explorer windows, that's very important). When everything is complete, restart your computer and, hopefully voila one nasty infection is gone.

Now we need to get the HijackThis into a folder so it can store HJT.exe, logs and backups for safety. Create a new folder and call it HJT. The move the HJT.exe and there should be a log there also, into the HJT folder. Now post a new log along with any comments you have and I will clean up anything left at that point.

G'Day mate, I am glad to be able to help out. Wondering which of the two fixes was successful? Are all of the offending toolbars gone? This can be a tough bugger to clean out. Let's go for what is in the log now, sometimes it takes a few runs to get that line left from the searchbar. Sometimes we have to remove it in safe mode. We will see how it goes, let's proceed like this:

1) You are running SpySweeper and by it's nature it will stop our HJT fix. You will have to turn it off until you are done with HJT. I do not have instructions for this one, if you provide those instructions I will have them for the next mate who needs them, but it must be totally turned off. You will know if something is left running if the items we fix are still there when you look at the next log.

2) Download CCleaner from this link: http://www.ccleaner.com/ Take the time to review the instructions on the download page so that when I ask you to run it you will know what you are doing.

3) Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:

Close all programs but HJT and all browser windows, then click on "Fix Checked"

This is optional, I have seen no trojans and the scan is a tad long. If you wish to know there are none hiding, you can run it, or you can save the link in case you ever want a trojan check...your call.Let's check for trojans, run this free online scan, scan the whole system and set it to clean or fix anything it locates. Let me know what it finds and the exact name and location of anything it locates but can't remove. You may be asked to install an ActiveX, please do so as this program is safe and it can not run without it.http://www.windowsecurity.com/trojanscan/

Run CCleaner then restart the computer and post a new log in this same thread along with any feedback you have. Let us know how you are running.